Home / Rules Library / GLBA
Mortgage AI Rules LibraryGLBA in plain English: borrower data, AI tools and your obligations
Last reviewed: October 28, 2026. General information, not legal advice. Short quotes come from the U.S. Code and eCFR; each is followed by a plain-English line. GLBA has many exceptions and details not covered here. Confirm your obligations with counsel.
The core obligation
"It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information."15 U.S.C. 6801(a)
In plain English: You must keep borrowers' personal financial information private and secure, all the time, not just when it is convenient.
Who counts as a financial institution
"A mortgage broker is a financial institution because brokering loans is a financial activity"16 CFR 314.2, example (xi)
In plain English: Mortgage brokers are covered. So are mortgage lenders, which the same rule lists among the entities the FTC oversees.
The two GLBA rules you work with
Privacy (Regulation P). For most nonbank mortgage brokers and lenders, the privacy rules are in the CFPB's Regulation P, 12 CFR Part 1016. It requires privacy notices to customers, limits disclosures of nonpublic personal information to nonaffiliated third parties, and gives consumers a right to opt out of many of those disclosures, subject to exceptions. The FTC's own privacy rule, 16 CFR Part 313, now covers only certain motor vehicle dealers.
Security (the Safeguards Rule). The FTC's Standards for Safeguarding Customer Information, 16 CFR Part 314, require a written information security program with specific elements. Our FTC Safeguards Rule page covers it in detail.
Why AI tools fall under the service provider rule
"The opt out requirements in §§ 1016.7 and 1016.10 of this part do not apply when you provide nonpublic personal information to a nonaffiliated third party to perform services for you or functions on your behalf, if you: (i) Provide the initial notice in accordance with § 1016.4; and (ii) Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information"12 CFR 1016.13(a)(1)
In plain English: When an AI vendor processes borrower data for you, you rely on a contract that stops the vendor using the data for anything else. That contract is usually the vendor's Data Processing Addendum.
This is why a signed DPA that covers the exact AI product matters. A personal AI account has no such contract with your company, so borrower data should never go into one.
A GLBA checklist for AI use
- List every AI tool that may receive borrower data, including AI inside your LOS, CRM and email.
- For each one, file a signed DPA that covers that product and limits the vendor's use of the data.
- Check that your privacy notice describes sharing with service providers.
- Block personal AI accounts for borrower data and collect a staff attestation.
- Apply your Safeguards Rule program to AI tools: access limits, MFA, logging, retention and vendor oversight.
- Keep connectors to email and drives off unless you have an Enterprise plan with a signed DPA, or a documented exception.
Related: Can I connect AI to my work email? and the AI controls checklist.
Document vendor contracts and staff attestations
The $349 AI Policy Kit includes a vendor questionnaire and an AI use inventory, plus 3 months of Small Shop portal access with the DPA and SOC 2 tracker and staff sign-off tracking.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
Does GLBA apply to mortgage brokers?
Yes. The FTC Safeguards Rule says a mortgage broker is a financial institution because brokering loans is a financial activity.
Which privacy rule applies to a mortgage broker?
For most nonbank mortgage brokers and lenders, the CFPB’s Regulation P, 12 CFR Part 1016. The FTC’s Part 313 now covers only certain motor vehicle dealers.
Can we put borrower data into ChatGPT or Grok?
Only into a company account covered by a contract that limits the vendor’s use of the data, such as a signed DPA covering that product, and only with your safeguards in place. Never into a personal account.
Is this legal advice?
No. GLBA has many exceptions. Confirm your obligations with counsel.